Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
157s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
15/08/2021, 17:51
General
-
Target
403990C6CBB042F7C1F5E57177272F81.exe
-
Size
1.3MB
-
MD5
403990c6cbb042f7c1f5e57177272f81
-
SHA1
ab9ef44ed7b93ecf7b6c43f23d75a3f2dc9d5a1b
-
SHA256
42af92e5be37c1daddda7672372a39ccebb24d31d2ea65bec2a74dfbc3a4e82c
-
SHA512
cb1adffb69f4ff6a62257325504cebc41d22f41910a41eae9c04ec5327da9f58fb652e79b87f580c7ac6f81f27cf2fba77b4fc3947b27dd59ae376f2d7c57ee5
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\403990C6CBB042F7C1F5E57177272F81.exe"C:\Users\Admin\AppData\Local\Temp\403990C6CBB042F7C1F5E57177272F81.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zmvsznja.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4339.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4338.tmp"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
124KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
22.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14.6MB
-
Filesize
4KB
-
Filesize
4KB